Another allowed-ips question

Reuben Martin at
Sun Nov 19 00:55:38 CET 2017

On Nov 18, 2017 5:44 PM, "Ryan Whelan" <rcwhelan at> wrote:

I'm working on a system where Wireguard machines can connect directly to
one another as well as communicate with one another via an intermediary
router (or 'server').

When 2 machines directly connect to one another, the allowed-ips setting is
obviously a non-issue; what i'm struggling with is if they are unable to
communicate directly and build routes to one another via an intermediary
router (which is also connected to each 'client' via wireguard).  Unless
the 'server' NATs the traffic, the allowed-ips setting will prevent the
'clients' from communicating.  Am i missing something?

I'm trying to avoid building a wg interface for each peer connection if
possible, but i'm failing to see any other way around it.  Either NAT at
the intermediary router or create an interface per-peer.

Are there other options?

I have something kinda similar. I set up vxlan connections overtop of the
wireguard connections and added the vxlan interfaces to bridges.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the WireGuard mailing list